CVE-2023-41991

Published: Sep 21, 2023Modified: Nov 5, 2025CISA KEV

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Affected (5)

Products: Apple: Ipados, Iphone Os, Macos

3 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 16.7
Apple Ipados	Version 17.0
Apple Iphone Os	Before 16.7
Apple Iphone Os	Version 17.0
Apple Macos	From 13.0 to 13.6

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (7)

https://support.apple.com/en-us/HT213927

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/en-us/HT213931

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/en-us/HT213927

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://support.apple.com/en-us/HT213931

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://support.apple.com/kb/HT213927

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://support.apple.com/kb/HT213931

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41991

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.